CVE-2026-17591 Libarchive: libarchive: use-after-free via aliased mac metadata copy
Attackers can trigger a use-after-free in Libarchive to cause denial of service or read uninitialized memory via crafted archive metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-17591?
CVE-2026-17591 is a low-severity use after free vulnerability in Red Hat Enterprise Linux 10, published on 16 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
Weakness: CWE-416
Which versions are affected by CVE-2026-17591?
Linux distribution packages (6)
bsdcat Red Hat:hummingbird:1 | All versions | 0:3.8.9-2.1.hum1 |
bsdcpio Red Hat:hummingbird:1 | All versions | 0:3.8.9-2.1.hum1 |
bsdtar Red Hat:hummingbird:1 | All versions | 0:3.8.9-2.1.hum1 |
bsdunzip Red Hat:hummingbird:1 | All versions | 0:3.8.9-2.1.hum1 |
libarchive Red Hat:hummingbird:1 | All versions | 0:3.8.9-2.1.hum1 |
libarchive-devel Red Hat:hummingbird:1 | All versions | 0:3.8.9-2.1.hum1 |
How do I fix CVE-2026-17591?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-17591 being exploited?
There is no known exploitation of CVE-2026-17591 in the wild and no public exploit code.
Sources
Also known as AZL-109785, AZL-109788, BELL-CVE-2026-17591, DEBIAN-CVE-2026-17591, ECHO-7b1a-3e8b-4a35, GHSA-x7v4-6qhp-jg74 and 6 more.